CVE-2026-10565 (GCVE-0-2026-10565)
Vulnerability from cvelistv5
Published
2026-06-02 01:30
Modified
2026-10-21 09:02
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-362 - Race Condition
Summary
A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm_state_security_mode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.
References
| URL | Tags | |||||||||||||||||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
|
||||||||||||||||||||||||||
Impacted products
{
"containers": {
"adp": [
{
"metrics": [
{
"other": {
"content": {
"id": "CVE-2026-10565",
"options": [
{
"Exploitation": "poc"
},
{
"Automatable": "no"
},
{
"Technical Impact": "partial"
}
],
"role": "CISA Coordinator",
"timestamp": "2026-06-02T12:22:40.203143Z",
"version": "2.0.3"
},
"type": "ssvc"
}
}
],
"providerMetadata": {
"dateUpdated": "2026-06-02T12:22:53.847Z",
"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
"shortName": "CISA-ADP"
},
"title": "CISA ADP Vulnrichment"
}
],
"cna": {
"affected": [
{
"cpes": [
"cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*"
],
"modules": [
"NGAP Handover"
],
"product": "Open5GS",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "2.7.0"
},
{
"status": "affected",
"version": "2.7.1"
},
{
"status": "affected",
"version": "2.7.2"
},
{
"status": "affected",
"version": "2.7.3"
},
{
"status": "affected",
"version": "2.7.4"
},
{
"status": "affected",
"version": "2.7.5"
},
{
"status": "affected",
"version": "2.7.6"
}
]
}
],
"credits": [
{
"lang": "en",
"type": "finder",
"value": "Seungjoon Na (Kookmin University ICSR Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Jinha Kim (Kookmin University ICSR Lab)"
},
{
"lang": "en",
"type": "finder",
"value": "Hwankuk Kim (Kookmin University ICSR Lab)"
},
{
"lang": "en",
"type": "reporter",
"value": "Seungjoon Na (VulDB User)"
},
{
"lang": "en",
"type": "analyst",
"value": "Seungjoon Na (VulDB User)"
},
{
"lang": "en",
"type": "coordinator",
"value": "VulDB CNA Team"
}
],
"descriptions": [
{
"lang": "en",
"value": "A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm_state_security_mode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance."
}
],
"metrics": [
{
"cvssV4_0": {
"baseScore": 2.3,
"baseSeverity": "LOW",
"vectorString": "CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P",
"version": "4.0"
}
},
{
"cvssV3_1": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.1"
}
},
{
"cvssV3_0": {
"baseScore": 3.1,
"baseSeverity": "LOW",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C",
"version": "3.0"
}
},
{
"cvssV2_0": {
"baseScore": 2.1,
"vectorString": "AV:N/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C",
"version": "2.0"
}
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-362",
"description": "Race Condition",
"lang": "en",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2026-10-21T09:02:05.612Z",
"orgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"shortName": "VulDB"
},
"references": [
{
"name": "VDB-367672 | Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition",
"tags": [
"vdb-entry",
"technical-description"
],
"url": "https://vuldb.com/vuln/367672"
},
{
"name": "VDB-367672 | CTI Indicators (IOB, IOC, IOA)",
"tags": [
"signature",
"permissions-required"
],
"url": "https://vuldb.com/vuln/367672/cti"
},
{
"name": "CVE-2026-10565 | CVE Analysis and Report",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/cve/CVE-2026-10565"
},
{
"name": "Submit #818938 | open5gs v2.7.6 Race Condition",
"tags": [
"third-party-advisory"
],
"url": "https://vuldb.com/submit/818938"
},
{
"tags": [
"issue-tracking"
],
"url": "https://github.com/open5gs/open5gs/issues/4497"
},
{
"tags": [
"issue-tracking",
"patch"
],
"url": "https://github.com/open5gs/open5gs/pull/4501"
},
{
"tags": [
"exploit"
],
"url": "https://github.com/user-attachments/files/27111025/N2-SMC-Concurrent.zip"
},
{
"tags": [
"product"
],
"url": "https://github.com/open5gs/open5gs/"
}
],
"timeline": [
{
"lang": "en",
"time": "2026-06-01T00:00:00.000Z",
"value": "Advisory disclosed"
},
{
"lang": "en",
"time": "2026-06-01T02:00:00.000Z",
"value": "VulDB entry created"
},
{
"lang": "en",
"time": "2026-10-21T11:06:55.000Z",
"value": "VulDB entry last update"
}
],
"title": "Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition",
"x_generator": [
"VulDB PVTS v202610"
]
}
},
"cveMetadata": {
"assignerOrgId": "1af790b2-7ee1-4545-860a-a788eba489b5",
"assignerShortName": "VulDB",
"cveId": "CVE-2026-10565",
"datePublished": "2026-06-02T01:30:09.909Z",
"dateReserved": "2026-06-01T16:31:37.602Z",
"dateUpdated": "2026-10-21T09:02:05.612Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.2",
"vulnerability-lookup:meta": {
"vulnrichment": {
"containers": "{\"adp\": [{\"title\": \"CISA ADP Vulnrichment\", \"metrics\": [{\"other\": {\"type\": \"ssvc\", \"content\": {\"id\": \"CVE-2026-10565\", \"role\": \"CISA Coordinator\", \"options\": [{\"Exploitation\": \"poc\"}, {\"Automatable\": \"no\"}, {\"Technical Impact\": \"partial\"}], \"version\": \"2.0.3\", \"timestamp\": \"2026-06-02T12:22:40.203143Z\"}}}], \"providerMetadata\": {\"orgId\": \"134c704f-9b21-4f2e-91b3-4a467353bcc0\", \"shortName\": \"CISA-ADP\", \"dateUpdated\": \"2026-06-02T12:22:47.504Z\"}}], \"cna\": {\"title\": \"Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition\", \"credits\": [{\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Seungjoon Na (Kookmin University ICSR Lab)\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Jinha Kim (Kookmin University ICSR Lab)\"}, {\"lang\": \"en\", \"type\": \"finder\", \"value\": \"Hwankuk Kim (Kookmin University ICSR Lab)\"}, {\"lang\": \"en\", \"type\": \"reporter\", \"value\": \"Seungjoon Na (VulDB User)\"}, {\"lang\": \"en\", \"type\": \"analyst\", \"value\": \"Seungjoon Na (VulDB User)\"}, {\"lang\": \"en\", \"type\": \"coordinator\", \"value\": \"VulDB CNA Team\"}], \"metrics\": [{\"cvssV4_0\": {\"version\": \"4.0\", \"baseScore\": 2.3, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:4.0/AV:N/AC:H/AT:N/PR:L/UI:N/VC:N/VI:N/VA:L/SC:N/SI:N/SA:N/E:P\"}}, {\"cvssV3_1\": {\"version\": \"3.1\", \"baseScore\": 3.1, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C\"}}, {\"cvssV3_0\": {\"version\": \"3.0\", \"baseScore\": 3.1, \"baseSeverity\": \"LOW\", \"vectorString\": \"CVSS:3.0/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:N/A:L/E:P/RL:X/RC:C\"}}, {\"cvssV2_0\": {\"version\": \"2.0\", \"baseScore\": 2.1, \"vectorString\": \"AV:N/AC:H/Au:S/C:N/I:N/A:P/E:POC/RL:ND/RC:C\"}}], \"affected\": [{\"cpes\": [\"cpe:2.3:a:open5gs:open5gs:*:*:*:*:*:*:*:*\"], \"vendor\": \"n/a\", \"modules\": [\"NGAP Handover\"], \"product\": \"Open5GS\", \"versions\": [{\"status\": \"affected\", \"version\": \"2.7.0\"}, {\"status\": \"affected\", \"version\": \"2.7.1\"}, {\"status\": \"affected\", \"version\": \"2.7.2\"}, {\"status\": \"affected\", \"version\": \"2.7.3\"}, {\"status\": \"affected\", \"version\": \"2.7.4\"}, {\"status\": \"affected\", \"version\": \"2.7.5\"}, {\"status\": \"affected\", \"version\": \"2.7.6\"}]}], \"timeline\": [{\"lang\": \"en\", \"time\": \"2026-06-01T00:00:00.000Z\", \"value\": \"Advisory disclosed\"}, {\"lang\": \"en\", \"time\": \"2026-06-01T02:00:00.000Z\", \"value\": \"VulDB entry created\"}, {\"lang\": \"en\", \"time\": \"2026-10-21T11:06:55.000Z\", \"value\": \"VulDB entry last update\"}], \"references\": [{\"url\": \"https://vuldb.com/vuln/367672\", \"name\": \"VDB-367672 | Open5GS NGAP Handover gmm-sm.c gmm_state_security_mode race condition\", \"tags\": [\"vdb-entry\", \"technical-description\"]}, {\"url\": \"https://vuldb.com/vuln/367672/cti\", \"name\": \"VDB-367672 | CTI Indicators (IOB, IOC, IOA)\", \"tags\": [\"signature\", \"permissions-required\"]}, {\"url\": \"https://vuldb.com/cve/CVE-2026-10565\", \"name\": \"CVE-2026-10565 | CVE Analysis and Report\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://vuldb.com/submit/818938\", \"name\": \"Submit #818938 | open5gs v2.7.6 Race Condition\", \"tags\": [\"third-party-advisory\"]}, {\"url\": \"https://github.com/open5gs/open5gs/issues/4497\", \"tags\": [\"issue-tracking\"]}, {\"url\": \"https://github.com/open5gs/open5gs/pull/4501\", \"tags\": [\"issue-tracking\", \"patch\"]}, {\"url\": \"https://github.com/user-attachments/files/27111025/N2-SMC-Concurrent.zip\", \"tags\": [\"exploit\"]}, {\"url\": \"https://github.com/open5gs/open5gs/\", \"tags\": [\"product\"]}], \"x_generator\": [\"VulDB PVTS v202610\"], \"descriptions\": [{\"lang\": \"en\", \"value\": \"A security flaw has been discovered in Open5GS up to 2.7.6. The impacted element is the function gmm_state_security_mode of the file src/amf/gmm-sm.c of the component NGAP Handover. Performing a manipulation results in race condition. The attack can be initiated remotely. The complexity of an attack is rather high. The exploitability is regarded as difficult. The exploit has been released to the public and may be used for attacks. The pull request to fix this issue awaits acceptance.\"}], \"problemTypes\": [{\"descriptions\": [{\"lang\": \"en\", \"type\": \"CWE\", \"cweId\": \"CWE-362\", \"description\": \"Race Condition\"}]}], \"providerMetadata\": {\"orgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"shortName\": \"VulDB\", \"dateUpdated\": \"2026-10-21T09:02:05.612Z\"}}}",
"cveMetadata": "{\"cveId\": \"CVE-2026-10565\", \"state\": \"PUBLISHED\", \"dateUpdated\": \"2026-10-21T09:02:05.612Z\", \"dateReserved\": \"2026-06-01T16:31:37.602Z\", \"assignerOrgId\": \"1af790b2-7ee1-4545-860a-a788eba489b5\", \"datePublished\": \"2026-06-02T01:30:09.909Z\", \"assignerShortName\": \"VulDB\"}",
"dataType": "CVE_RECORD",
"dataVersion": "5.2"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…